ISAE 3402 readiness

ISAE 3402 is the international standard for a service auditor's report on the controls of a service organization that matter to its customers' financial reporting. Customers in Europe and in finance ask for it. A Type 1 report covers the design at a date, a Type 2 report also the operation over a period.

What it requires

The main obligations in plain words, with the article or clause they come from.

  • The report

    Choose the report type and period, define the scope, prepare the description of the system and provide management's written assertion.

  • Control objectives

    Specify the control objectives and the risks that threaten them; decide whether subservice organizations are carved out or included.

  • Customer controls

    Name the controls your customers must operate themselves: the complementary user entity controls.

  • The audit

    Support the service auditor, investigate deviations and respond to them.

How Atitic covers it

What the product does for this framework, on the same records as every other.

  • Twelve starter IT control objectives, from logical access to personnel security, that you word for your organization; your wording appears wherever the objective does.

  • Controls from the library mapped to the objectives, with test plans and results.

  • Subservice organizations in the vendor register; audit request lists and evidence packs for the service auditor.

  • Fasttrack recommends ISAE 3402 when customers ask for it, and for ICT providers to financial entities.

What the catalogue holds

The areas of the framework in Atitic and how many requirements each holds. When you adopt it, each requirement becomes a row you own and link to policies, evidence and controls.

  • 1 The report and its scope5
  • 2 Responsibilities of the service organization6
  • 3 Starter control objectives12

Related frameworks: DORA SOC 2 ISO 27001

Common questions

ISAE 3402 or SOC 2?

Both are auditor's reports on a service organization's controls. ISAE 3402 is international and covers controls that matter to customers' financial reporting; SOC 2 follows US standards and the Trust Services Criteria. SOC 1 is the US counterpart of ISAE 3402.

Who issues the report?

An independent service auditor, usually an audit firm. Atitic keeps the description, objectives, controls and evidence ready for it.

Does an ISAE 3402 report help with DORA?

Financial entities must monitor their ICT providers, and many accept an ISAE 3402 report as part of that assurance.

A summary for orientation, not legal advice. The official text is the reference.

Try it on your own data

Adopt ISAE 3402 in a free trial, link the evidence you already have and see what is still missing.

Start a free trial